1. Genetic data as sensitive data
Genetic data is sensitive personal data and receives reinforced protection. Its processing requires the express consent of the data subject, except for legal exceptions.
2. Principles
- Purpose: processed only for explicit, legitimate and previously informed purposes.
- Proportionality and minimization: limited to the necessary data.
- Quality: we seek its accuracy and updating.
- Security and confidentiality: protected with technical and organizational measures.
- Accountability: we maintain traceability of processing.
3. Reinforced consent
The processing of genetic data is based on the express, free, informed and specific consent of the data subject, documented through the corresponding Informed Consent.
4. Separation of contexts
We apply separation between information of patients, companies and professionals, controlling access according to role and need to know.
5. Technical and organizational measures
- Role-based access control on a need-to-know basis.
- Encryption and pseudonymization where appropriate.
- Activity logs and traceability.
- Confidentiality agreements with staff and processors.
6. Processors and transfers
Processors handling genetic data will do so under documented instructions and security obligations. Transfers, including international ones, will be carried out with adequate safeguards in accordance with the law.
7. Retention and deletion
Genetic data is kept only for as long as necessary for the informed purposes and legal obligations, and is then securely deleted or anonymized.
8. Non-discrimination
In accordance with Law No. 20,120, any arbitrary discrimination based on people's genetic heritage is prohibited.
9. Rights and how to exercise them
The data subject may exercise their rights of access, rectification, cancellation or erasure, objection, portability and blocking by writing to contacto@multiplex.bio.
10. Security incidents
In the event of a breach affecting genetic data, we will adopt containment measures and make the communications required by law to the authority and, where appropriate, to the data subjects.